Hotspot Question You have peering configured as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented…

Question

Exhibits

Answer Area

• NSG1 limits VM1 trafficNo
• NSG1 applies to VM2Yes
• VM1 and VM2 connect to the same virtual networkYes

Explanation

Azure VNet Peering & NSG Hotspot - Explained

Statement 1: "NSG1 limits VM1 traffic" -> No

Why No: NSG1 is associated with VM2's subnet (or VM2's NIC directly), not VM1's subnet or NIC. In Azure, an NSG only enforces rules on the specific subnet or network interface it is explicitly associated with. Since VM1 sits on a different subnet (or NIC) with no NSG1 attachment, NSG1 has zero authority over VM1's inbound or outbound traffic.

Key concept: NSG scope is strictly local - association determines enforcement, not proximity.

Statement 2: "NSG1 applies to VM2" -> Yes

Why Yes: NSG1 is directly associated with either VM2's subnet or VM2's NIC. When an NSG is associated at the subnet level, it applies to all VMs in that subnet, including VM2. Azure evaluates both subnet-level and NIC-level NSGs, so VM2's traffic flows through NSG1's rules.

Key concept: Subnet-level NSG -> all VMs in that subnet inherit the rules.

Statement 3: "VM1 and VM2 connect to the same virtual network" -> Yes

Why Yes: Despite the exhibit showing peering, VM1 and VM2 are both deployed within the same VNet - peering here refers to that VNet being peered with another external VNet, not that VM1 and VM2 are in separate VNets. They share the same address space and virtual network boundary, just on different subnets.

Key concept: Peering connects two distinct VNets; same-VNet VMs need no peering to communicate.

Memory Tip

"NSG guards the door it's assigned to - not the whole building."

• Same VNet ≠ same NSG scope
• Peering = bridge between two buildings; same VNet = same building, different rooms

No community discussion yet for this question.